RNS-CKKS Scheme. Among all HE schemes, RNS-CKKS is the only scheme that supports fixed-point arithmetic operations. Recent PPNNs [1]}, [2]} use RNS-CKKS to achieve shorter inference latency and higher inference accuracy than the PPNN [3]} implemented by other HE schemes. Via SIMD batching, a RNS-CKKS-based PPNN encrypts \(\frac{N}{2}\)  fixed-point numbers in \(\frac{N}{2}\)  slots of a single ciphertext, where \(N\)  is the polynomial degree of the ciphertext. One HE operation on the ciphertext simultaneously performs the same operation on each slot of the ciphertext. A ciphertext is a polynomial of degree \(N\)  with each coefficient represented modulo \(Q\) , where \(Q\)  is a product of \(r\)  primes \(Q=\prod _{j=1}^{r}{Q_j}\) . To represent a fixed-point number, RNS-CKKS uses an integer \(I\)  and a scaling factor \(S\) . For instance, 3.14 can be denoted by \(I=314\)  and \(S=100\) . \(S\)  grows exponentially with HE multiplication. To keep \(S\)  within check, a rescaling operation is required to convert \(I\times 100\)  at scale \(S\)  to \(I\)  at scale \(S\times 100\) . Totally, RNS-CKKS permits \(r\)  rescaling operations. A rescaling operation converts a \(r\) -level ciphertext \(C_r\)  (which has noise \(e\) , modulus \(Q\) , and plaintext \(m\) ) to a \((r-1)\) -level ciphertext \(C_{r-1}\)  (which has noise \(\frac{e}{Q_r}\) , modulus \(\frac{Q}{Q_r}\) , and plaintext \(\frac{m}{Q_r}\) ). \((C_{r-1}, \frac{m}{Q_r}, \frac{e}{Q_r}, \frac{Q}{Q_r})=Rescale(C_r, m, e, Q)\) . The computational complexity of various RNS-CKKS operations on \(r\) -level ciphertexts is shown in Table REF . A rescaling operation makes the following operations faster, since the latency of a HE operation on a \((r-1)\) -level ciphertext \(C_{r-1}\)  is shorter than that of the same operation on the \(r\) -level ciphertext \(C_{r}\) . Moreover, a rescaling operation also reduces noise in the ciphertext.
